User Guide

About Dr Solomon’sAnti-Virus
32 Dr Solomon’sAnti-Virus
Encrypted polymorphic virus detection
Along with generic virus variant detection, the scan engine now incorporates
a generic decryption engine, a set of routines that enables Dr Solomon’s
Anti-Virus to track viruses that try to conceal themselves by encrypting and
mutating their code signatures. These “polymorphic” viruses are notoriously
difficult to detect, since they change their code signature each time they
replicate.
This meant that the simple pattern-matching method that earlier scan engine
incarnations used to find many viruses simply no longer worked, since no
constant sequence of bytes existed to detect. To respond to this threat, Dr
Solomon’s researchers developed the PolyScan Decryption Engine, which
locates and analyzes the algorithm that these types of viruses use to encrypt
and decrypt themselves. It then runs this code through its paces in an
emulated virtual machine in order to understand how the viruses mutate
themselves. Once it does so, the engine can spot the “undisguised” nature of
these viruses, andthereby detect them reliablyno matter howtheytry to hide
themselves.
“Double heuristics” analysis
As afurtherengine enhancement,Dr Solomon’s researchers havehoned early
heuristic scanning technologies—originally developed to detect the
astonishingflood of macrovirus variantsthateruptedafter 1995—into asetof
precision instruments. Heuristic scanning techniques rely on the engine’s
experiencewithpreviousvirusestopredictthelikelihoodthatasuspiciousfile
is an as-yet unidentified or unclassified new virus.
The scan engine now incorporates ViruLogic, a heuristic technique that can
observe a program’s behavior and evaluate how closely it resembles either a
macro virus or a file-infecting virus. ViruLogic looks for virus-like behaviors
in program functions, such as covert file modifications, background calls or
invocations of e-mail clients, and other methods that viruses can use to
replicatethemselves.Whenthenumberofthesetypesofbehaviors—ortheir
inherent quality—reaches a predetermined threshold of tolerance, the engine
fingers the program as a likely virus.
The enginealso “triangulates” itsevaluation bylooking forprogram behavior
that no virus would display—prompting for some types of user input, for
example—inordertoeliminatefalse positive detections.Thisdouble-heuristic
combination of “positive” and “negative” techniques results in an
unsurpassed detection rate with few, if any, costly misidentifications.